Message-ID: <55A50B09.4010005@electrum.org>
Date: Tue, 14 Jul 2015 15:13:45 +0200
From: Thomas Voegtlin <thomasv@electrum.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: bitcoin-dev@lists.linuxfoundation.org
References: <CA+w+GKQbOMz5nb_SnLB6Xb0FYzNZ_rEj5nbNjm2jY0+L8JJGAA@mail.gmail.com>	<55A4AF62.4090607@electrum.org>
	<55A4F058.4020800@bitcoins.info>
In-Reply-To: <55A4F058.4020800@bitcoins.info>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Proposal: extend bip70 with OpenAlias
Precedence: list


Le 14/07/2015 13:19, Milly Bitcoin a =E9crit :
>=20
>> If your email account is hacked and someone else gets a certificate in
>> your name, you'd be unable to *know* about it, because they would use =
a
>> different CA.
>=20
> Maybe I am confused but I thought you are using DNSSEC to sign the zone=
s
> so only the domain owner could issue certificates for a zone (or
> corresponding email address).  If you have "example.com" the domain
> owner of the domain would sign zone "joe.example.com" which can
> correspond to the "joe@example.com" email address.  Under this scenario
> you would only have one CA per domain.
>=20

One CA per domain is indeed what I want to achieve. The paragraph you
quoted was about the current situation with email certs, where that is
not the case.